Merchant data processing agreement

Version 2026-09-16 (connection wording clarified 20 September 2026; processing instructions and obligations unchanged). This agreement covers Akdly's controlled Shopify pilot. The store owner can accept it inside Akdly; acceptance is recorded for that store and this version. It does not create a paid subscription or authorize marketing.

Parties and instructions

The merchant controls the purposes of processing its customers' personal data. Ahmed Mohamed, operating Akdly, processes that data on the merchant's behalf to provide the order workflows the merchant configures. Instructions consist of installing the app, configuring and enabling its flow, choosing order actions, and requesting support or deletion. Akdly will not sell customer data, use customer content for advertising, or process it for unrelated purposes.

Data, people and duration

The data concerns the merchant's customers and authorized store users. It includes store and order identifiers, customer names and phone numbers, order items and values, payment and fulfillment states, addresses needed for review, message content and delivery events, consent/opt-out records, and access and usage records. Processing continues while the service is provided, subject to deletion and the limited retention below.

Responsibilities

The merchant must have authority to supply the data, give customers appropriate notices and permissions, choose order-related messages, and honor customer rights. Akdly limits access to authorized people who need it for service or support and requires confidential handling. Akdly applies tenant isolation, authenticated owner actions, encryption for protected stored fields and credentials, HTTPS, signed webhook checks, minimized access logs and encrypted backups. These measures are not a claim of certification or zero risk.

Services and locations

The merchant instructs Akdly to exchange the necessary information with Shopify and its linked WhatsApp account. Akdly uses application/database hosting and Cloudflare for public HTTPS traffic. The current server network allocation is registered to SpectraIP B.V. and publicly located in Amsterdam, Netherlands; this is network evidence, not a guarantee of the underlying hosting reseller or every processing location. A restricted encrypted recovery copy is kept on the operator's workstation. Contact [email protected] for the current processing inventory.

Connect the store's WhatsApp account by scanning a QR code from Linked devices on the phone. This agreement grants no authorization from WhatsApp or Meta. Public rollout remains subject to the separate transport and processor-arrangement checks. Akdly will disclose material changes to its purposes or services before they apply and seek a new agreement version where required. If a merchant cannot authorize a proposed change, it can pause the flow, disconnect, request export/deletion, or uninstall.

Rights and incidents

Akdly assists the merchant with access, correction, export and deletion requests through the app's privacy controls and support. Customers should contact the merchant where they ordered. Akdly will notify an affected merchant without undue delay after becoming aware of a personal-data breach, provide available facts and updates, and cooperate with the merchant's response. The merchant remains responsible for its own customer or authority notices. Assistance or an export request is never permission to disclose another store's data.

Return and deletion

The merchant can request its data before uninstalling. Exports expire after seven days; Shopify privacy webhooks and support requests trigger store-scoped handling. Customer content in terminal cases is erased after 90 days without activity. Active/review/unknown-send cases and minimal suppression, deduplication, billing and deletion evidence remain only for the disclosed service and recovery purposes. Encrypted backups expire after fourteen days; restored data stays isolated until later deletions have been reapplied. The minimal keyed Free-eligibility record survives reinstall and erasure to prevent repeat trials. Full details are in the privacy notice.

Contact and evidence

For data instructions, security questions or information demonstrating these controls, contact [email protected]. Akdly records the agreement version, document fingerprint, store identifier, accepting owner's identifier and acceptance time. The agreement record is removed with the store's application record under the store-deletion process.